1 files changed, 12 insertions, 1 deletions

diff --git a/drivers/media/dvb-frontends/stv0367.c b/drivers/media/dvb-frontends/stv0367.c
index 0c8e45949b11..f6c7277999fe 100644
--- a/drivers/media/dvb-frontends/stv0367.c
+++ b/drivers/media/dvb-frontends/stv0367.c
@@ -33,6 +33,9 @@
 #include "stv0367_regs.h"
 #include "stv0367_priv.h"
 
+/* Max transfer size done by I2C transfer functions */
+#define MAX_XFER_SIZE  64
+
 static int stvdebug;
 module_param_named(debug, stvdebug, int, 0644);
 
@@ -767,7 +770,7 @@ static struct st_register def0367cab[STV0367CAB_NBREGS] = {
 static
 int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
 {
-        u8 buf[len + 2];
+        u8 buf[MAX_XFER_SIZE];
         struct i2c_msg msg = {
                 .addr = state->config->demod_address,
                 .flags = 0,
@@ -776,6 +779,14 @@ int stv0367_writeregs(struct stv0367_state *state, u16 reg, u8 *data, int len)
         };
         int ret;
 
+        if (2 + len > sizeof(buf)) {
+                printk(KERN_WARNING
+                       "%s: i2c wr reg=%04x: len=%d is too big!\n",
+                       KBUILD_MODNAME, reg, len);
+                return -EINVAL;
+        }
+
+
         buf[0] = MSB(reg);
         buf[1] = LSB(reg);
         memcpy(buf + 2, data, len);